Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for some help in capturing network traffic that I can analyze in Wireshare (or other tools). The tool I'm using is mallory.

If anyone is familiar with mallory, I could use some help. I've got it configured and running correctly, but I don't know how to get the output that I want.

The setup is on my private network. I have a VM (running Ubuntu 12.04 - precise) with two NICs:

  • eth0 is on my "real" network
  • eth1 is only on my "fake" network, and is using dnsmasq (for DNS and DHCP for other devices on the "fake" network)

Effectively eth0 is the "WAN" on my VM, and eth1 is the "LAN" on my VM.

I've setup mallory and iptables to intercept, decrypt, encrypt and rewrite all traffic coming in on destination port 443 on eth1. On the device I want intercepted, I have imported the ca.cer that mallory generated as a trusted root certificate.

I need to analyze some strange behavior in the HTTPS stream between the client and server, so that's why mallory is setup in between for this MITM.

I would like to take the decrypted HTTPS traffic and dump it to either a logfile or a socket in a format compatible with tcpdump/wireshark (so I can collect it later and analyze it).

Running tcpdump on eth1 is too soon (it's encrypted), and running tcpdump on eth2 is too late (it's been re-encrypted). Is there a way to make mallory "tcpdump" the decrypted traffic (in both directions)?

share|improve this question

migrated from serverfault.com Sep 12 '12 at 20:57

This question came from our site for professional system and network administrators.

    
This seems like the thing you would create a debug rule for. Personally, I tend to use stunnel for debugging things like this, I find it is easier to setup. –  Zoredache Sep 12 '12 at 20:55
    
You should have a bri interface up. Can you paste here 'ifconfig' output? –  user16908 Dec 10 '12 at 13:25

1 Answer 1

I ran into this same problem, although not with Mallory (I never had any luck getting Mallory working, although I only tried shortly after its release). If you can configure the target IP in the client, you should be able to do use my solution too. I used stunnel in combination with a ruby tcp relay proxy. I blogged about what I did here: http://www.fishnetsecurity.com/6labs/blog/ssl-relay-proxy-creative-solution-complex-issue

I have a friend that used these steps work to get mallory working, and it worked fine for him. http://blog.opensecurityresearch.com/2012/05/mallory-mitm-fix-ssl-decryption.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.